Merge "Add fix for SQL injection."

2 files changed, 17 insertions, 5 deletions

diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/CreateBrmsParamPolicy.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/CreateBrmsParamPolicy.java
index 047342ad0..923e528fa 100644
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/CreateBrmsParamPolicy.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/components/CreateBrmsParamPolicy.java
@@ -38,6 +38,8 @@ import java.util.UUID;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import javax.script.SimpleBindings;
+
 import org.apache.commons.io.FilenameUtils;
 import org.onap.policy.common.logging.eelf.MessageCodes;
 import org.onap.policy.common.logging.eelf.PolicyLogger;
@@ -189,8 +191,10 @@ public class CreateBrmsParamPolicy extends Policy {
 	private String getValueFromDictionary(String templateName){
 		String ruleTemplate = null;
 		CommonClassDaoImpl dbConnection = new CommonClassDaoImpl();
-		String queryString="from BRMSParamTemplate where param_template_name= '"+templateName+"'";
-		List<Object> result = dbConnection.getDataByQuery(queryString);
+		String queryString="from BRMSParamTemplate where param_template_name= :templateName";
+		SimpleBindings params = new SimpleBindings();
+		params.put("templateName", templateName);
+		List<Object> result = dbConnection.getDataByQuery(queryString, params);
 		if(!result.isEmpty()){
 			BRMSParamTemplate template = (BRMSParamTemplate) result.get(0);
 			ruleTemplate = template.getRule();
diff --git a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/daoimpl/CommonClassDaoImpl.java b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/daoimpl/CommonClassDaoImpl.java
index 2cc211701..7b50397ca 100644
--- a/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/daoimpl/CommonClassDaoImpl.java
+++ b/ONAP-PAP-REST/src/main/java/org/onap/policy/pap/xacml/rest/daoimpl/CommonClassDaoImpl.java
@@ -21,6 +21,9 @@
 package org.onap.policy.pap.xacml.rest.daoimpl;
 
 import java.util.List;
+import java.util.Map;
+
+import javax.script.SimpleBindings;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -228,24 +231,29 @@ public class CommonClassDaoImpl implements CommonClassDao{
 		return data;
 	}
 
-
+	
 	@SuppressWarnings("unchecked")
 	@Override
-	public List<Object> getDataByQuery(String query) {
+	public List<Object> getDataByQuery(String query, SimpleBindings params) {
 		Session session = sessionFactory.openSession();
 		Transaction tx = session.beginTransaction();
 		List<Object> data = null;
 		try {
 			Query hbquery = session.createQuery(query);
+			for (Map.Entry<String, Object> paramPair : params.entrySet()) {
+				hbquery.setParameter(paramPair.getKey(), paramPair.getValue());
+			}
 			data = hbquery.list();
 			tx.commit();
 		} catch (Exception e) {
-			LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Error While Querying Database Table"+e);	
+			LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Error While Querying Database Table"+e);
+			throw e;
 		}finally{
 			try{
 				session.close();
 			}catch(Exception e1){
 				LOGGER.error(XACMLErrorConstants.ERROR_PROCESS_FLOW + "Error While Closing Connection/Statement"+e1);
+				throw e1;
 			}
 		}
 		return data;